Analysis
- max time kernel
146s - max time network
148s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
10/06/2026, 02:00
Behavioral task
behavioral1
Sample
wife.arm4.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
5 signatures
150 seconds
General
- Target wife.arm4.elf
- Size 57KB
- Sample260610-cffqcsct7x
- SHA256 fb5dc78d2edf4e30d7a73df176f90665910508558f6ce12c9178d113ca8bb30f
- MD5 011be9d9d016df7cdaa810e4ad50b490
- SHA1 0772b91255acdb81e71044c490649697f59f4899
- SHA512 bf9996aee69d9ca179cbaca8e2608d1efeb5180bcc96e3009e3e7742e40d39c6d965e7de260cd6c07c9bcf222af0b953815f093d651e67c5655e906d7c095f16
- SSDEEP 768:2c7fWZ0t+kgKqWJQm0VJn3vfesPJxX7JXPbOD8kXJFAwIZlSNI9xnyiTEdg+Ow3h:mZ0YGJTy2EjVfGXHALUNaxyiYCRVI
- TLSH T1584302215B5878B6CC3404F5F6298B56AE1D1DFAD1EA337FD31AC106966BCB5C0AC603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 788 wife.arm4.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/23/maps wife.arm4.elf File opened for reading /proc/36/maps wife.arm4.elf File opened for reading /proc/193/maps wife.arm4.elf File opened for reading /proc/367/maps wife.arm4.elf File opened for reading /proc/781/maps wife.arm4.elf File opened for reading /proc/4/maps wife.arm4.elf File opened for reading /proc/19/maps wife.arm4.elf File opened for reading /proc/198/maps wife.arm4.elf File opened for reading /proc/317/maps wife.arm4.elf File opened for reading /proc/617/maps wife.arm4.elf File opened for reading /proc/16/maps wife.arm4.elf File opened for reading /proc/51/maps wife.arm4.elf File opened for reading /proc/142/maps wife.arm4.elf File opened for reading /proc/334/maps wife.arm4.elf File opened for reading /proc/314/maps wife.arm4.elf File opened for reading /proc/360/maps wife.arm4.elf File opened for reading /proc/673/maps wife.arm4.elf File opened for reading /proc/5/maps wife.arm4.elf File opened for reading /proc/9/maps wife.arm4.elf File opened for reading /proc/31/maps wife.arm4.elf File opened for reading /proc/34/maps wife.arm4.elf File opened for reading /proc/337/maps wife.arm4.elf File opened for reading /proc/797/maps wife.arm4.elf File opened for reading /proc/32/maps wife.arm4.elf File opened for reading /proc/8/maps wife.arm4.elf File opened for reading /proc/29/maps wife.arm4.elf File opened for reading /proc/35/maps wife.arm4.elf File opened for reading /proc/46/maps wife.arm4.elf File opened for reading /proc/18/maps wife.arm4.elf File opened for reading /proc/20/maps wife.arm4.elf File opened for reading /proc/24/maps wife.arm4.elf File opened for reading /proc/340/maps wife.arm4.elf File opened for reading /proc/777/maps wife.arm4.elf File opened for reading /proc/2/maps wife.arm4.elf File opened for reading /proc/10/maps wife.arm4.elf File opened for reading /proc/11/maps wife.arm4.elf File opened for reading /proc/26/maps wife.arm4.elf File opened for reading /proc/143/maps wife.arm4.elf File opened for reading /proc/764/maps wife.arm4.elf File opened for reading /proc/21/maps wife.arm4.elf File opened for reading /proc/22/maps wife.arm4.elf File opened for reading /proc/17/maps wife.arm4.elf File opened for reading /proc/42/maps wife.arm4.elf File opened for reading /proc/57/maps wife.arm4.elf File opened for reading /proc/202/maps wife.arm4.elf File opened for reading /proc/220/maps wife.arm4.elf File opened for reading /proc/316/maps wife.arm4.elf File opened for reading /proc/355/maps wife.arm4.elf File opened for reading /proc/731/maps wife.arm4.elf File opened for reading /proc/6/maps wife.arm4.elf File opened for reading /proc/7/maps wife.arm4.elf File opened for reading /proc/14/maps wife.arm4.elf File opened for reading /proc/25/maps wife.arm4.elf File opened for reading /proc/33/maps wife.arm4.elf File opened for reading /proc/45/maps wife.arm4.elf File opened for reading /proc/785/maps wife.arm4.elf File opened for reading /proc/3/maps wife.arm4.elf File opened for reading /proc/12/maps wife.arm4.elf File opened for reading /proc/13/maps wife.arm4.elf File opened for reading /proc/30/maps wife.arm4.elf File opened for reading /proc/56/maps wife.arm4.elf File opened for reading /proc/637/maps wife.arm4.elf File opened for reading /proc/726/maps wife.arm4.elf File opened for reading /proc/28/maps wife.arm4.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself jbd2/sda1-8 788 wife.arm4.elf -
description ioc Process File opened for reading /proc/56/cmdline wife.arm4.elf File opened for reading /proc/57/cmdline wife.arm4.elf File opened for reading /proc/673/cmdline wife.arm4.elf File opened for reading /proc/781/cmdline wife.arm4.elf File opened for reading /proc/797/cmdline wife.arm4.elf File opened for reading /proc/10/cmdline wife.arm4.elf File opened for reading /proc/679/cmdline wife.arm4.elf File opened for reading /proc/726/cmdline wife.arm4.elf File opened for reading /proc/780/cmdline wife.arm4.elf File opened for reading /proc/3/cmdline wife.arm4.elf File opened for reading /proc/19/cmdline wife.arm4.elf File opened for reading /proc/360/cmdline wife.arm4.elf File opened for reading /proc/28/cmdline wife.arm4.elf File opened for reading /proc/9/cmdline wife.arm4.elf File opened for reading /proc/11/cmdline wife.arm4.elf File opened for reading /proc/13/cmdline wife.arm4.elf File opened for reading /proc/46/cmdline wife.arm4.elf File opened for reading /proc/193/cmdline wife.arm4.elf File opened for reading /proc/198/cmdline wife.arm4.elf File opened for reading /proc/617/cmdline wife.arm4.elf File opened for reading /proc/24/cmdline wife.arm4.elf File opened for reading /proc/5/cmdline wife.arm4.elf File opened for reading /proc/17/cmdline wife.arm4.elf File opened for reading /proc/637/cmdline wife.arm4.elf File opened for reading /proc/4/cmdline wife.arm4.elf File opened for reading /proc/21/cmdline wife.arm4.elf File opened for reading /proc/33/cmdline wife.arm4.elf File opened for reading /proc/73/cmdline wife.arm4.elf File opened for reading /proc/731/cmdline wife.arm4.elf File opened for reading /proc/self/exe wife.arm4.elf File opened for reading /proc/6/cmdline wife.arm4.elf File opened for reading /proc/12/cmdline wife.arm4.elf File opened for reading /proc/35/cmdline wife.arm4.elf File opened for reading /proc/51/cmdline wife.arm4.elf File opened for reading /proc/334/cmdline wife.arm4.elf File opened for reading /proc/23/cmdline wife.arm4.elf File opened for reading /proc/25/cmdline wife.arm4.elf File opened for reading /proc/7/cmdline wife.arm4.elf File opened for reading /proc/20/cmdline wife.arm4.elf File opened for reading /proc/22/cmdline wife.arm4.elf File opened for reading /proc/45/cmdline wife.arm4.elf File opened for reading /proc/317/cmdline wife.arm4.elf File opened for reading /proc/16/cmdline wife.arm4.elf File opened for reading /proc/220/cmdline wife.arm4.elf File opened for reading /proc/355/cmdline wife.arm4.elf File opened for reading /proc/764/cmdline wife.arm4.elf File opened for reading /proc/777/cmdline wife.arm4.elf File opened for reading /proc/26/cmdline wife.arm4.elf File opened for reading /proc/143/cmdline wife.arm4.elf File opened for reading /proc/244/cmdline wife.arm4.elf File opened for reading /proc/314/cmdline wife.arm4.elf File opened for reading /proc/337/cmdline wife.arm4.elf File opened for reading /proc/34/cmdline wife.arm4.elf File opened for reading /proc/784/cmdline wife.arm4.elf File opened for reading /proc/202/cmdline wife.arm4.elf File opened for reading /proc/316/cmdline wife.arm4.elf File opened for reading /proc/2/cmdline wife.arm4.elf File opened for reading /proc/8/cmdline wife.arm4.elf File opened for reading /proc/29/cmdline wife.arm4.elf File opened for reading /proc/31/cmdline wife.arm4.elf File opened for reading /proc/32/cmdline wife.arm4.elf File opened for reading /proc/340/cmdline wife.arm4.elf File opened for reading /proc/15/cmdline wife.arm4.elf File opened for reading /proc/42/cmdline wife.arm4.elf